Anthropic
Cyber Verification Program
Connect repos Keep testing Auto-fixes as PRsNo dashboard to babysit.
Set it up once.
Then get back to building.
Every investigation
builds on the last.
Context about your code, architecture and past findings carries into the next investigation. As your software changes, that context helps guide what to test next.
We are in the cyber programs of
OpenAI Daybreak
Trusted Access for Cyber
Microsoft
Security Advisor
Security grounded
in research.
We find novel vulnerabilities in real software and work with maintainers on fixes. You can read the public evidence.
Engineers at these companies deployed our fixes into their software.
CriticalRX buffer overflow on zero-length serial framesLinux kernel · mctp
CVE-2026-68124 · CNA 9.6 CriticalCriticalArbitrary code execution via crafted expressionsjsonata
CVE-2026-77413 · GHSA-8gq3-vp5j-2grpCriticalCross-tenant agent API-token minting@paperclipai/server
MediumAnonymous /api/systemstatus leaks exception detailSwiss Federal Chancellery · government code
HighSlab use-after-free in AEAD decrypt completionLinux kernel · TIPC
CVE-2026-63801HighUse-after-free in MACsec offload RXLinux kernel · mlx5e
CVE-2026-72072HighMissing CAP_NET_ADMIN check on changelinkLinux kernel · vxlan / geneve
CVE-2026-68142 + CVE-2026-68432HighOOB read on frames shorter than the auth tagLinux kernel · mac802154
CVE-2026-68125HighMemory corruption in 802.15.4 llsec decryptLinux kernel · mac802154
CVE-2026-63831HighUse-after-free of metadata_dst in eswitch repr releaseLinux kernel · ice
Queued upstreamHighResource-exhaustion denial of servicejsonata
CVE-2026-52746HighUse-after-free in LE Audio CIG/CIS setupLinux kernel · Bluetooth
CVE-2026-63944HighStack buffer overflow in NFC digitalLinux kernel · NFC
CVE-2026-80803HighDouble-completion / double-free on resumeLinux kernel · xen-blkfront
Merged upstreamHighCertificate-chain validation bypassnode-forge
HighDenial of service via unbounded recursionprotobuf.js
HighInteger overflow in HTTP chunked-transfer parser → heap OOB readnng (nanomsg)
HighOOB from unvalidated ioctl buffer sizesLinux kernel · atomisp
In reviewHighUse-after-free on inrange_timer at teardownLinux kernel · HID uclogic
In reviewHighStale pen_input pointer on partial registrationLinux kernel · HID uclogic
In reviewHighUse-after-free of in-use VP9 framesLinux kernel · meson vdec
In reviewMediumOOB read on LLCP PDUs shorter than the headerLinux kernel · NFC
CVE-2026-80798CVSS pendingNULL-deref DoS paths via AMDXDNA_EXEC_CMDLinux kernel · amdxdna
CVE-2026-72091 + CVE-2026-72092CVSS pendingOOB read from assoc length underflowLinux kernel · ath6kl
CVE-2026-89524CVSS pendingNULL deref on HT-cap without HT-oper in TDLSLinux kernel · mwifiex
CVE-2026-68197CVSS pendingOut-of-bounds read from unset MAC header on packet-socket TXLinux kernel · net/packet
CVE-2026-74667MediumOOB read in LLCP connect_sn TLV walkLinux kernel · NFC
CVE-2026-80800MediumOOB read in st21nfca ATR_REQ handlingLinux kernel · NFC
CVE-2026-80823CVSS pendingOOB read from unvalidated directory-index countsLinux kernel · ocfs2
CVE-2026-89492CVSS pendingUse-after-free from carrier_work rearm on disconnectLinux kernel · ipheth
CVSS pendingUse-after-free of ghl_poke_timer / ghl_urb at driver unbindLinux kernel · HID sony
MediumHeap out-of-bounds write in ciscodump extcapWireshark
MediumTemplate injection → arbitrary file readUptime Kuma
MediumStack overflow via deeply nested collectionsyaml
MediumOut-of-bounds read in LLCP SNL TLV parserLinux kernel · NFC
Merged upstreamMediumInteger overflow in frame-size calculationLinux kernel · atomisp
In reviewMediumOOB read from unvalidated AV1 frame indicesLinux kernel · v4l2-ctrls
In reviewMediumOOB in NPU cmdstream tile validationLinux kernel · accel/ethosu
In reviewMediumOOB read in firmware-request handlerLinux kernel · Bluetooth btnxpuart
In reviewMediumOOB read in HT/VHT capability IE parsingLinux kernel · mwifiex
In reviewMediumOOB read in pairwise-cipher OUI walkLinux kernel · mwifiex
In reviewMediumECRED deferred-recvmsg race → list corruptionLinux kernel · Bluetooth L2CAP
In reviewMediumOOB read in port100 frame length handlingLinux kernel · NFC
In reviewLowReachable WARN DoS in rsa-pkcs1pad empty digestLinux kernel · crypto
Queued upstreamA sample of what we've found. More are disclosed continuously, and others stay under embargo and NDA.
A few things worth knowing.
How does this fit our agent workflow?
Keep building with your coding agents. We run security reviews and pentests, verify findings and fixes, and open PRs for your engineers or agents to review.
What access does 0.security need?
We agree the repositories, systems and permissions with you before testing starts. We handle setup and connect the service to your existing workflow.
Talk to usWho reviews and merges the fixes?
Your team does. We reproduce findings and test the fixes in isolated sandboxes, then deliver the evidence and proposed change together. Your engineers or coding agents review the PRs and decide what to merge.
Do we need to keep checking a dashboard?
No. Once we agree the scope, schedule and budget, we handle ongoing testing and deliver verified findings and fix PRs through your workflow. You don’t need to start scans or tests manually.
What can you test?
Your source code, dependencies, websites, APIs, apps, cloud infrastructure, operating systems and AI systems. The service includes PR reviews, codebase scans, secret checks, monitoring and white-box, grey-box and black-box pentesting. We tailor the testing to your stack.
Can you help with compliance reporting?
Yes. We provide testing evidence and reports for your SOC 2 and ISO 27001 work. We agree what you need to report as part of the engagement.
How do we get started?
Talk to us about your stack and priorities. We’ll agree the scope, schedule and budget, then handle setup and ongoing security testing.
Talk to usWant to run it yourself? Explore the free, open-source harness.
You provide the models and infrastructure.